PANOS 5.0.8 User-ID problem.

[wijasa]

Did anyone have a problem with user identification (IP from AD thru User-ID application), I have above with 5.0.8, on 5.0.7 is OK. Users from local subnet are correct discovered, but from other then PA subnets arent.

Regards

Adam

[apasupulati]

Hello Adam,

Since you mentioned this was working on PANOS 5.0.7, was the device upgraded or is that on a different firewall? Can you clarify if you're using the agent or the agentless?

Do you have any include or exclude lists configured? Under the zone configuration or the user-id config.

Pick a user machine whose mapping is not learnt and verify the logon server. Run "set l" at the windows cmd prompt to see which logon server the user logged onto. Confirm the user-id service is connected to the logon server/DC. If everything is setup correctly, we'd have to look at the logs.

If using agentless, you can enable debugs for user-id service and tail the useridd.log. Or you can enable debug level logging on the user-id agent and check the Uadebug logs in the agent's directory.

You can also refer:

https://live.paloaltonetworks.com/docs/DOC-5662

Regards,

Aditi

[wijasa]

Hello, thanks for replay,

I use user-id agent, the service running on w2k8 r2 DC with domain admin privilege (they point to two domain controller, first local where service are running and second in the same subnet), everything goes good to moment when I update PANOS to 5.0.8 from 5.0.7, (when the problem act I was back to 5.0.7). In User-ID users connecting from all subnets are good discovered with they IP/username, but on Monitor->Traffic device don't recognize user name from AD with IP source from other than PA subnets. I have "include list" configured for all subnets, agent are properly connect with servers and device.

Regards,

Adam

[apasupulati]

If all the ip-mappings are discovered on the agent and not the firewall -

1. Are these users from a different subnet coming from a different source zone? all the source zones will need to have User-Id enabled so users can be identified on the firewall.

2. If coming from the same zone as the identified subnet, I'd re-check if the zone has any User-id ACL (include/exclude list) configured.

[wijasa]

Yes... you have right!

I has not checked include/exclude list on firewall, only on agent, and on firewall was only one include subnets (from with users/IP are correct discovered). But this signifies that mechanism acts presently different/bad (In PANOS 5.0.7)

After rush hour i will update fw and check it.

Thanks and regards.

Adam